Comparitech got confirmation from the victim in 89 of the 187 cases [3], a 47.6% confirmation rate [2], with 98 claims resting only on what the gang said [3] -- nearly half the count is leak-site bookkeeping. The Gentlemen's ledger holds up better than most of the field: 10 of its 22 claims were confirmed [7], 45% [12]. Qilin confirmed 9 of 21, LockBit 7 of 14, INC 6 of 10 [6][7]. Taken together, the top five strains account for 79 of the 187 claims, 42% of the half-year [4].
Median demands fell 80% [5] while the attack count rose 13.3% [1], pricing running opposite to volume. That is a smaller ask spread across more victims, and the half-year record holds too few confirmed payments to show whether it converts better.
Comparitech puts known records breached in confirmed attacks at just under 179,000 [13]; Suffolk, Virginia accounts for 157,725 of them [14], 88% [7] -- the breach total is essentially one city. The three largest known breaches together cover 173,921 people, leaving roughly 5,000 across every other confirmed attack in the period [8]. Suffolk is also the case worth reading closely: the attack was stopped before ransomware was deployed, and Cloak still claimed 2.5 TB of stolen data [14].
Government agencies take about four months on average to notify breach victims [17], all three of the largest H1 breaches date to Q1 [17], and last month the City of Middletown, Ohio began notifying 123,791 people about a July 2025 incident [18], a single 2025 attack equal to 69% of the entire H1 2026 figure [9] -- so that 179,000 figure will grow.
Comparitech attributes part of the US decline to The Gentlemen not concentrating inside the US the way Qilin has [10]. Strain-level movement is consistent with that reading: Qilin claims against government targets fell 45% while LockBit's rose 250% [8]. The researchers also flag that this sector report was compiled after their general H1 2026 report, so the numbers may shift as more attacks are confirmed [21].
